مسدودکننده سایت‌های خارجی (Internet Melli) WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.4.2

Findings

2

Worst severity

medium

Content hash

27cf00945b3d2137c47d306e… Copy

Findings

• medium Emergency tool download missing capability and CSRF nonce

  missing_capability

  admin_post_im_download_emergency_tool is reachable by any logged-in user (Subscriber+). The handler performs no current_user_can or nonce check, fetches a remote .txt over HTTP from mirror.talashnet.ir, and streams it as direct-plugin-manager.php. CSRF from a logged-in victim is sufficient.

  internet-melli.php:90-128

  Recommendation

  Require current_user_can(manage_options) and check_admin_referer; prefer HTTPS; do not serve remote PHP utilities without integrity verification.

• low Unauthenticated feedback AJAX registered (nonce only in admin)

  unnecessary_attack_surface

  wp_ajax_nopriv_im_send_feedback accepts posts with im_feedback_nonce and forwards text to an external HTTP endpoint. The nonce is only rendered on the admin settings page, so unauth abuse is limited, but the nopriv registration is unnecessary attack surface.

  internet-melli.php:56-57,136-183

  Recommendation

  Remove nopriv registration; require manage_options for feedback.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.